MCP, MCP server
io.github.abelljs/abell
io.github.abelljs/abell, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
packages/abell/src/cli/generate.ts, line 206
fs.unlinkSync(HTML_FILE); - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
packages/abell-ai/src/mcp.ts, line 29
const syntaxGuide = await fetch('https://abelljs.org/llms.txt').then( - SECRETS_PATH_DOTENV Low
Mentions a .env file.
.gitignore, line 74
# dotenv environment variables file - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
pnpm-lock.yaml, line 1
lockfileVersion: '9.0'
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
packages/abell/src/cli/generate.ts, line 206
fs.unlinkSync(HTML_FILE);
packages/abell/src/utils/internal-utils.ts, line 96
fs.unlinkSync(curPath);
packages/abell/src/utils/internal-utils.ts, line 303
fs.unlinkSync(path.join(ROOT, 'package.json'));
Show more
packages/abell/src/utils/internal-utils.ts, line 307
fs.unlinkSync(path.join(ROOT, 'package-lock.json'));
packages/create-abell/src/utils.ts, line 184
fs.unlinkSync(curPath);
scripts/post-build.js, line 13
fs.unlinkSync(curPath);
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach your-wordpress-site.com. The description does not name that host.
NETWORK_UNNAMED_HOST
packages/abell-ai/src/mcp.ts, line 29
const syntaxGuide = await fetch('https://abelljs.org/llms.txt').then(
packages/docs/content/posts/one.mdx, line 117
const response = await fetch('https://your-wordpress-site.com/wp-json/wp/v2/posts').then((res) => res.json());
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.gitignore, line 74
# dotenv environment variables file
.gitignore, line 75
.env
packages/docs/.gitignore, line 4
dump/
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
pnpm-lock.yaml, line 1
lockfileVersion: '9.0'
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Note
the latest commit is more than 365 days old.
MAINTAINER_STALE
No file path was stored.
2025-09-17T20:24:00+05:30
Note
Hygiene check of commit 7f58349a08ba. can delete files. can reach your-wordpress-site.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. the latest commit is more than 365 days old.
Date and source
Date checked:
github.com
Commit graded: 7f58349a08ba4223fa6e80006435fca7b8036d17
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.